AI sessions | AI Agent Security

When a developer runs an AI coding tool, that tool reads files, runs commands, and reaches out to the network on their behalf, and none of it appears in a code review. The AI Sessions page records each session so you can see which sessions produced findings, ran the most commands, or reached the most destinations.

Scope of this guide

This guide explains the AI Sessions page: the summary cards, the findings and time range controls, the session list and its columns, and how to search, filter, and sort. It does not cover opening an individual session or changing what the agent records.

Prerequisites

You have administrator access to the tenant.
At least one developer has run an AI coding tool on an endpoint with the AI Agent Security agent.

Open the AI Sessions page

Go to Intelligence > AI Sessions.

The line below the page title summarizes every recorded session, such as 1725 sessions · 26 developers · 5 tools. It does not change with the controls below; the count above the list does.

Summary cards

Card	Description
Sessions	The number of sessions. Select the card to clear every filter.
Findings	The number of findings across those sessions, with the number rated High below. Select the card to show only sessions with at least one finding.

A finding is an action a policy blocked or audited during the session. Findings is the card to check first: a single session with a High finding matters more than a dozen sessions that ran a lot of commands.

Narrow the view

Three sets of controls sit above the list, and they combine. The list shows sessions that match all of them.

Findings filter

Select All, With findings, or High severity. All is selected by default.

Time range

Select 7d, 30d, or 90d to cover the last 7, 30, or 90 days. 30d is selected by default.

Because 30d is the default, the page opens on a filtered view. A session from four months ago is absent until you select 90d, and even then only if it falls inside that window.

Search and filters

To search, select the Developer, repo or path... box and enter your text. The list narrows as you type.

To filter by developer or tool, select Filter, choose the column, then choose the values you want to keep.

When you arrive from an endpoint, the list is already narrowed to that endpoint and a Host chip shows above the list. Select the X on the chip to show every endpoint again.

Column reference

Column	Description
Started	The date and time the session began, in your local time.
Developer	The user who ran the session, with the endpoint name below.
Tool	The AI coding tool used, such as Claude Code, shown with its icon.
Repo	The repository the session worked in, with the branch and working directory below. A dash (`—`) means no repository was identified.
Events	The number of events recorded in the session, with the number of prompts below.
MCP	The number of MCP servers the session used.
Egress	The number of outbound network connections the session made.
Exec	The number of commands the session ran.
Findings	The number of findings in the session, with the number rated High below. A colored dot beside the count means a policy blocked at least one action.
Duration	How long the session lasted.

Read Repo and its path together. A session whose path is a system directory such as C:\Windows\system32 rather than a project folder is worth opening, whatever its findings count.

Each row is a link. Select a row to open the session's details panel, or open it in a new browser tab to keep your place in the list.

Sort the list

Select a column heading to sort by that column. Select the same heading again to reverse the order. You can sort on Developer, Tool, Repo, Events, MCP, Egress, Exec, and Findings. Started and Duration cannot be sorted.

Sorting Exec in descending order surfaces the sessions that ran the most commands, which is usually where the most happened without anyone watching.

Load more sessions

The list loads more sessions as you scroll. When every matching session is showing, the end of the list reads All sessions loaded.

Verify the results

Confirm that the count above the list matches the findings filter and time range you selected. All three narrowing controls stay active at once, so a short list may be the result of a filter and a time range rather than a quiet fleet.

Check any session with an unusually long Duration, such as several days. Duration runs from a session's first to its last recorded event.

Next steps

Select High severity and open each session to see which policy fired and on what.
Sort on Egress and confirm the sessions with the most outbound connections had a reason to make them.
Select 90d to check whether a pattern you found in the last 30 days is new or long-running.